THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86759 (HIGH 7.1) — Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries,

[NVD] CVE-2026-86759 (HIGH 7.1) — Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries,

mednvdPublished 2026-09-09

CVE-2026-86759 CVSS: 7.1 HIGH Published: 2026-09-09T14:17:25.593

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

Indicators of compromise

CVE-2026-86759cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86759